Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host injecting spoofed reporting messages into the Supervisory Control and Data Acquisition (SCADA) data path -- Open Platform Communications Unified Architecture (OPC UA) data change notifications with fabricated values, or historian tag writes that override device-sourced values -- from a process that is not the recognized data acquisition process. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Windows Registry Key Modification (DC0063) | opc:applog | Open Platform Communications (OPC) server data change notification or value write from client_id not matching authorized data acquisition service |
| Field | Description |
|---|---|
| SensorToleranceThreshold | Acceptable divergence between primary and independent secondary measurement of the same physical quantity. |
| ZeroVarianceWindow | Time window over which reported values are checked for implausible stability. |
Real-time monitoring identifies a Linux process generating Industrial Control System (ICS) protocol unsolicited responses or publishing Open Platform Communications Unified Architecture (OPC UA) data changes for device addresses it does not own, from a User Identifier (UID) not associated with the authorized data acquisition service. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | decoded ICS protocol unsolicited response or OPC UA data-change message for a device/address not normally owned by the observed source |
| Field | Description |
|---|---|
| SensorToleranceThreshold | Acceptable divergence between primary and independent secondary measurement of the same physical quantity. |
| ZeroVarianceWindow | Time window over which reported values are checked for implausible stability. |
Real-time monitoring cross-correlates a field device's reported telemetry against an independent secondary measurement, identifying cases where the reported value diverges from the independent reading while the device's network-layer identity shows a MAC mismatch against its enrolled hardware address. Spoofed reporting messages are, by definition, designed to look protocol-valid. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process History/Live Data (DC0107) | operationaldb:ProcessHistory | reported values show statistically improbable stability during a period when physical process is known to be actively changing |
| Network Traffic Flow (DC0078) | NSM:Flow | reporting message for device_ip originates from src_mac not matching enrolled hardware address for that Internet Protocol (IP) |
| Device Alarm (DC0108) | processsensor:RedundantComparison | device-reported value for a tag diverges from independently measured value for same physical quantity by more than sensor tolerance threshold |
| Field | Description |
|---|---|
| SensorToleranceThreshold | Acceptable divergence between primary and independent secondary measurement of the same physical quantity. |
| ZeroVarianceWindow | Time window over which reported values are checked for implausible stability. |
Real-time monitoring identifies Industrial Control System (ICS) unsolicited response messages such as Distributed Network Protocol 3 (DNP3) unsolicited or Generic Object Oriented Substation Event (GOOSE) frames arriving from Internet Protocol (IP) or Media Access Control (MAC) addresses that do not match the enrolled device for those data points. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Flow | unsolicited response message source identity does not match the enrolled device for those data points |
| Field | Description |
|---|---|
| SensorToleranceThreshold | Acceptable divergence between primary and independent secondary measurement of the same physical quantity. |
| ZeroVarianceWindow | Time window over which reported values are checked for implausible stability. |